CVE-2026-111868: Deserialization in datastax pulsar-jms

This vulnerability affects the decode function in the file pulsar-jms/src/main/java/com/datastax/oss/pulsar/jms/messages/PulsarObjectMessage.java of datastax pulsar-jms up to version 9.0.3. The flaw allows remote attackers to manipulate deserialization, potentially leading to security issues. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. The project was notified early but has not provided a response or patch. Exploit code has been publicly disclosed, though no active exploitation in the wild is currently known.

The vulnerability allows remote attackers to initiate deserialization attacks via the decode function, which could lead to security risks such as remote code execution or data manipulation depending on the deserialization context. The CVSS score of 5.3 reflects a medium impact with network attack vector, low complexity, no privileges required, and no user interaction needed.

No official fix or patch is currently available from the vendor. Users should monitor the vendor advisory for updates. Until a patch is released, consider restricting network access to the affected service and applying any available application-level controls to limit deserialization inputs.